2026

SAFU

Pangolin

when

<p>Binance is covering the losses from the attack of October 29, 2026 in full, by its own account. The exchange puts the affected sum at around $6.3 billion and states that it will cover all losses, from company funds and from an emergency fund. That fund is called SAFU and holds 15,000 bitcoin, according to Binance. For the first time, the exchange's reserve is being weighed against a sum it cannot cover on its own.</p>
<p>If you hold coins on a crypto exchange, more hangs on this episode than a damage figure. It shows what a reimbursement actually rests on in an emergency: on the solvency and the pledge of the provider, not on a statutory guarantee. This piece sorts the numbers, names the sources and shows which rules apply in Germany when a custodian fails.</p>
<h2 id="6-3-billion-what-binance-itself-says-about-the-damage">$6.3 billion: what Binance itself says about the damage</h2>
<p>Binance gives the estimated total impact of the attack as around $6.3 billion. The exchange writes that user funds are safe and that it will absorb all losses. Changpeng Zhao, co-founder and by his own account the largest shareholder, wrote on X that he expects full coverage of all customer balances. Zhao has not run the platform since 2023.</p>
<p>The sum clearly exceeds the previous record. At Bybit in February 2025, around $1.5 billion flowed out according to figures at the time. The current sum is therefore about four times that. Aravind Srinivasan, who heads systematic OTC trading at market maker GSR, told Reuters, as reported by <a href="https://www.cnn.com/2026/10/30/tech/binance-crypto-heist-hnk-intl" rel="noopener noreferrer nofollow">CNN Business</a>, that it is the largest attack of this kind so far.</p>
<h3 id="what-has-already-been-frozen">What has already been frozen</h3>
<p>Part of the funds is blocked. According to the firms involved, around $3 billion was identified and frozen in wallets attributed to the attacker. Tether chief Paolo Ardoino names more than $1.567 billion, Circle chief Jeremy Allaire speaks of several hundred million dollars. We have broken down the composition of these freezes in a count of our own (as of October 30, 2026).</p>
<p>Frozen does not mean recovered. Stablecoin issuers can block balances at an address so that they can no longer be moved. Whether and when these funds go back to Binance will be decided in proceedings that can take months.</p>
<h2 id="safu-fund-15-000-bitcoin-as-a-reserve-for-security-incidents">SAFU fund: 15,000 bitcoin as a reserve for security incidents</h2>
<p><strong>The SAFU fund is Binance's emergency reserve for losses from security incidents.</strong> The abbreviation stands for Secure Asset Fund for Users. Binance set it up in July 2018 and finances it from ten percent of trading fees. In February 2026 the exchange moved the fund entirely into bitcoin and has held 15,000 BTC since, at average acquisition costs of $67,000 per bitcoin according to its own figures.</p>
<p>The dollar value of that reserve moves with the price. At a bitcoin level of $78,386 on the morning of October 30, 2026 (Coinpaprika), 15,000 bitcoin come to around $1.18 billion. That calculation is ours and is no more than the holding multiplied by the day's price. The figures in the reporting diverge: Crypto Briefing named a value of $1.27 billion on October 4, 2026, while reports from October 29 speak of around $1 billion. What stands up is the range between $1 billion and $1.27 billion, not a single value.</p>
<p>Against $6.3 billion in damage, the reserve therefore covers barely a fifth. Binance has pledged a floor for the fund: should its market value fall below $800 million, it is to be topped up to $1 billion. The exchange has also announced regular audits.</p>
<h3 id="how-the-fund-worked-in-2019">How the fund worked in 2019</h3>
<p>The fund has a track record. In 2019 attackers took 7,000 bitcoin from Binance's hot wallets, worth around $40 million at the time. Binance covered that amount from the SAFU fund and customers lost nothing. The ratio was different then: the damage was well below the reserve. This time the fund alone is not enough, which is why Binance explicitly names company funds as well.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/binance_safu_fonds_erstattung_2_590551e7e0.webp" alt="Cork investigation board with note cards and red strings pulled taut, two hands stretching another one" width="1920" height="1080">
 <figcaption>
  Attributing an attack is built from traces on the blockchain and from the patterns of earlier cases.
 </figcaption>
</figure>
<h2 id="a-laptop-as-the-entry-point-the-cause-as-the-exchange-describes-it">A laptop as the entry point: the cause as the exchange describes it</h2>
<p>Binance names a compromised laptop belonging to an engineer as the preliminary result of its own investigation. This <em>allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions</em>, the exchange said according to <a href="https://www.cnn.com/2026/10/30/tech/binance-crypto-heist-hnk-intl" rel="noopener noreferrer nofollow">CNN Business</a>. A service container is a walled-off runtime environment in which a single service runs; whoever gains rights there can trigger the tasks that service is allowed to carry out.</p>
<p>Binance says it has revoked the affected address approval, temporarily suspended deposits and withdrawals while security checks run, and brought in law enforcement agencies and analytics firms. Deposits were running again according to reports on Thursday evening, while withdrawals remained paused at first. Co-founder Yi He named a window of 48 hours for the resumption. No confirmation that withdrawals are in fact running again was available when this piece was completed.</p>
<h2 id="north-korea-what-three-analytics-firms-attribute-and-what-stays-open">North Korea: what three analytics firms attribute and what stays open</h2>
<p>Three firms specialising in blockchain analysis attribute the attack to a North Korean group, each on its own reasoning. TRM Labs bases the attribution, by its own account, on robust findings both on and off the blockchain. Pangolin Intelligence of Singapore points to the analysis of the transactions and the comparison with earlier cases. A Chainalysis spokesperson told CNN Business the firm has high confidence that North Korea is behind the attack.</p>
<p>These are attributions by private companies, not an official finding and not a verdict. North Korea has denied accusations of this kind in the past. CNN has asked the North Korean mission to the UN as well as the FBI and the Secret Service for comment. In the previous record case at Bybit, North Korean groups were likewise held responsible.</p>
<h3 id="why-the-attribution-matters-in-practice">Why the attribution matters in practice</h3>
<p>How much comes back depends on where the attack came from. Chainalysis says it is tracking stolen funds moving across several blockchains, bitcoin and Ethereum among them. An analyst at Pangolin Intelligence told CNN the cat-and-mouse game has barely begun, and expects a network of money-laundering services to be used to swap the funds into other assets. The longer that takes, the more a reimbursement hangs on the company treasury rather than on recovered funds.</p>
<h2 id="deposit-insurance-why-crypto-balances-are-not-protected-like-bank-money">Deposit insurance: why crypto balances are not protected like bank money</h2>
<p><strong>Deposit insurance is a statutory protection that replaces bank balances up to a fixed sum if the institution fails.</strong> For bank deposits that sum stands at 100,000 euros per customer and institution in the EU. Crypto assets do not fall under it. Unlike bank deposits, balances in an exchange account are not automatically insured; a reimbursement is at the discretion of the exchange in question. That is exactly why Binance's pledge is the decisive factor in this case, and not a guarantee fund funded by everyone.</p>
<p>In practice that means: the larger the amount you leave on an exchange permanently, the more you rely on a single provider. Holders who keep positions for the long term and do not trade can move them into their own custody. Which devices do that and what they cost is in our <a href="https://cryptoticker.io/en/comparison/hardware-wallets/" rel="noopener noreferrer nofollow">hardware wallet comparison</a>. The price is personal responsibility: lose the access key and there is no office that resets it.</p>
<p>How twelve providers word their pledges to customers is something we assessed before the current case: <a href="https://cryptoticker.io/en/crypto-exchange-compensation-theft/" rel="noopener noreferrer nofollow">compensation after an exchange hack</a>. That crypto assets are as a rule not covered holds even where banks themselves offer crypto services.</p>
<h2 id="section-45-of-the-crypto-markets-supervision-act-who-owns-coins-in-custody-in-an-insolvency">Section 45 of the Crypto Markets Supervision Act: who owns coins in custody in an insolvency</h2>
<p>Germany has a mechanism of its own, and it applies not to a hack but to the insolvency of the custodian. <a href="https://www.gesetze-im-internet.de/kmag/__45.html" rel="noopener noreferrer nofollow">Section 45 of the Crypto Markets Supervision Act</a> assigns holdings in custody. In its wording: <em>a crypto asset held in custody for a customer in the course of crypto custody business is deemed to belong to that customer.</em> Under the law that does not apply where the customer has consented to the asset being disposed of for the account of the institution or of third parties.</p>
<p>Under subsection 2 the same rule covers the share in jointly held holdings and separately held private keys. Subsection 3 governs the costs: where a customer does not consent in insolvency proceedings to the transfer of the entire holding to another custodian, that customer bears the costs of segregation. This does not apply where the other institution's terms are unreasonable for them.</p>
<p>What that means in proceedings is something we worked through on a case of its own: <a href="https://cryptoticker.io/en/crypto-exchange-insolvency-segregation/" rel="noopener noreferrer nofollow">segregation or insolvency estate</a>. One point matters for placing the current case: Binance is not insolvent, and this section is no substitute for a reimbursement after an attack. It decides what happens when a custodian fails as a company.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/binance_safu_fonds_erstattung_3_4f6e0749a8.webp" alt="Heavy file trolley with stacked folders and red sealing wax in an empty courthouse corridor at night" width="1920" height="1080">
 <figcaption>
  Crypto assets held in custody count as the customer's property in Germany, with exceptions and cost rules.
 </figcaption>
</figure>
<h2 id="mica-segregation-duty-what-supervisors-in-the-eu-require">MiCA segregation duty: what supervisors in the EU require</h2>
<p><strong>The MiCA regulation is the EU rulebook for crypto service providers and has applied in stages since the end of 2024.</strong> For custody it prescribes that providers keep holdings held for customers separate from their own. That separation is the load-bearing protection: what is held separately does not fall into the estate that the provider's creditors can reach.</p>
<p>An authorisation under MiCA is not insurance, however. There is no fund that steps in when an authorised provider loses coins. What the authorisation delivers are duties of segregation, of organisation and of supervision. The individual duties are set out in our overview of the MiCA duties for crypto companies.</p>
<p>Whether a provider actually holds the authorisation is something you can check yourself. BaFin keeps a register and ESMA one for the EU; both are public and free to query. That an authorisation is not granted automatically was shown by the rejection of bitcoin.de's application in October 2026. A list of the exchanges with an authorisation and their terms is in our <a href="https://cryptoticker.io/en/comparison/best-regulated-exchange/" rel="noopener noreferrer nofollow">overview of regulated crypto exchanges</a>.</p>
<h2 id="price-reaction-bnb-bitcoin-and-ether-on-friday-morning">Price reaction: BNB, bitcoin and ether on Friday morning</h2>
<p>The market is giving ground without a fresh slump. Bitcoin stood at $78,386 on October 30, 2026, 1.74 percent below the previous day, and ether at $2,246, down 2.60 percent (Coinpaprika). <a href="https://cryptoticker.io/en/prediction/bnb-price-prediction/" rel="noopener noreferrer nofollow">BNB</a>, the token of the Binance blockchain, traded at $714. The daily change ranged between a loss of 4.59 percent (Coinpaprika) and 5.03 percent (OKX) depending on the data source.</p>
<p>Against the overnight low the picture has steadied. After the news broke, bitcoin and ether both fell sharply; according to CNN both were trading around 2 to 3 percent down by Friday midday in Hong Kong, and therefore above their lows. Over the week bitcoin stands 3.84 percent lower and BNB 3.96 percent.</p>
<h3 id="what-the-numbers-do-not-say">What the numbers do not say</h3>
<p>A loss of under 5 percent against damage of $6.3 billion looks small. The moves can be explained by the pledge of full coverage and by the $3 billion frozen, which caps the outflow. That explanation cannot be proven: which part of the move traces back to the attack and which to the US Federal Reserve's rate decision of October 28 cannot be separated out of the price data.</p>
<h2 id="binance-reimbursement-the-safu-fund-covers-barely-a-fifth-of-the-damage">Binance reimbursement: the SAFU fund covers barely a fifth of the damage</h2>
<p>The case is still running, and the damage figure is an estimate by the exchange. Three steps make sense now all the same.</p>
<ol>
 <li><strong>Check how much sits permanently in exchange accounts.</strong> For holdings you do not trade, your own custody is the alternative; the routes and the costs are in the <a href="https://cryptoticker.io/en/comparison/hardware-wallets/" rel="noopener noreferrer nofollow">hardware wallet comparison</a>.</li>
 <li><strong>Look up your provider's authorisation in the register.</strong> Which exchanges carry a MiCA authorisation and what they cost is in the <a href="https://cryptoticker.io/en/comparison/best-regulated-exchange/" rel="noopener noreferrer nofollow">overview of regulated crypto exchanges</a>.</li>
 <li><strong>Read your exchange's compensation clause.</strong> The pledges twelve providers give their customers are collected in our <a href="https://cryptoticker.io/en/crypto-exchange-compensation-theft/" rel="noopener noreferrer nofollow">assessment of compensation after exchange hacks</a>.</li>
</ol>
<p>What stays open is when withdrawals at Binance will run again, how much of the $3 billion frozen goes back, and whether the estimate of $6.3 billion holds. All three points decide which share of the reimbursement comes from the SAFU fund in the end and which from the company treasury.</p>
<p><em>(As of October 30, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)</em></p>

Binance SAFU fund: full reimbursement pledged for $6.3 billion

Table of Contents

CryptoTicker ENG

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!